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(54) A method and apparatus for digital watermarking of images 



(57) The present invention provides an invisible dig- 
ital watermarking technique that can sen/e the two pur- 
poses of ownership verification and authentication, that 
can detect changes in pixel values as well as image 
size, and that may be used in public key or alternatively, 
secret key watermarking systems. The watermark 
insertion procedure computes a hash function and then 
combines the output of the hashed function of a modi- 
fied image block, a key and various image parameters 
with a block of the watermark bitmap, resulting in a com- 
bined image block. As a final step to create a water- 
marked image block, the combined image block is 
inserted into the LSB of the modified image. The water- 
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mark extraction procedure takes the watermarked 
image block and creates two different image blocks: a 
first image block with the LSB's of the watermarked 
image block set to zero, and a second image block with 
the LSB's of the watermarked image block extracted. 
The watermark extraction procedure uses the hash 
function to calculate a digest of values, resulting in a 
hashed output. The hashed output is combined with the 
second image block, preferably using an exclusive OR 
function. The result of the confined hashed output with 
the second image block is a block of the extracted 
watermark. 
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Description 

BACKGROUND OF THE INVENTION 

[0001 ] Digital watermarking is a technique to insert a 
digital identifier into an image so that the identifier can 
be extracted for the purposes of ownership verification 
and/or authentication. By ownership verification, we 
mean that we can extract a digital identifier from a 
watermarked image that can be identrfied as being 
associated with a owner. Authentication refers to the 
fact that we can detect any change to the watermarked 
image. Digital watermarking is becoming increasingly 
important due to the popularity of the usage of digital 
images on the world wide web and in electronic com- 
merce. 

[0002] From the perspective of an image viewer, 
watermarks can be classified into two categories: visible 
and invisible. Visible watermarking refers to the class of 
watermarking procedures where a visible stamp. e.g., a 
company logo, is inserted into an image. The stamp is 
visible in similar fashion as the watermark to current 
U.S. dollar bills. U.S. Patent No. 5,530,759, entrtled 
"Color Correct Digital Watermarking of Images," to 
Braudaway et al. describes a method of inserting a visi- 
ble watermark into an original digital Image. Braudaway 
et al. teaches nrtodifying the brightness or darkness of 
the original image based on the position of the water- 
mark. The watermark insertion and extraction method- 
ology described in Braudaway et at. includes a random 
noise component which increases the difficulty of 
removal of the watermark from the original image by 
anyone except the authorized user. 
[0003] An invisible watermark is a digital identifier 
added to a digital image so that the resulting image is 
visibly indistinguishable from the original unmarked 
inr^ge. The invisible signature can be extracted or 
detected through a sequence of image processing oper- 
ations on the digital image. The article "Secure Spread 
Spectrum Watermarking for Multimedia," Tech. Rep. 95- 
10. NEC Research Institute. 1995 by 1. J. Cox, J. Kilian. 
T. Leighton, and T Shamoon, describes a method of 
inserting an invisible waternr^rk into a digital image. The 
Cox article describes transformation of an original 
image into a frequency domain representation of the 
image. From the frequency transformed representation 
of the image, the method described In Cox picks N fre- 
quency components of the image that are visually 
impatant and inserts a watermarking signal into these 
frequency components of the original image as a water- 
mark. 

[0004] One way to accomplish ownership verification 
is to associate a user key with a watermark so that the 
desired watermark can only be extracted from a water- 
marked image with the appropriate user key. Two con- 
ventional watermarking methodologies include: (1) 
secret key watermarking, that requires that both the 
owner and receiver possess the same secret key and 



(2) public key watermarking, that requires the use of two 
different keys: a private key. and a con'esponding public 
key. The private key is known only to the owner. The 
public key need not be seaet and is used by the 

5 receiver of the image to detect the watermark. A prob- 
lem with secret key watermarking Is that key exchange 
must occur before the actual transmission, typically via 
a more expensive secret alternative path, or nrtust be 
an-anged when sender and receiver are proximate. 

10 [0005] In the article "An invisible watermarking tech- 
nique for image verification,". M.M. Yeung and F Mint- 
zer. Proceedings of ICIP (Santa Barbara, CA), October 
1997. an authentication watermarking method Is 
described for a secret key system. In the method 

15 described in the Yeung article, a secret key is used in 
combination with a random number generator to gener- 
ate a look up table. The look up table defines a water- 
mark extraction procedure, which in turn suggests a 
watermark insertion step tiirough adjustments to the 

20 original image. In the watermark extraction step, the 
extracted watermark is compared to a known water- 
mark to determine if tiie original image has been modi- 
fied. Altiiough. the technique described by Yeung can 
detect changes to tiie pixel values of a watermarked 

25 image, it does not detect changes in image size result- 
ing from aopping or certain scaling algorithms. 
[0006] A metiiod of Invislt^le watermarking that can be 
used botii for purposes of ownership verification and 
authentication, tiiat can detect changes in pixel values 

30 as well as image size, and that may be used in public 
key or alternatively, secret key watermarking systems is 
needed. 

SUiVIMARY OF THE INVENTION 

35 

[0007] The present invention provides an invisible dig- 
ital watermarking technique that can serve the two pur- 
poses of ownership verification and authentication, that 
can detect changes in pixel values as well as image 

40 size, and tiiat may be used in public key or alternatively, 
secret key watermarking systems. The present inven- 
tion includes a watermark insertion procedure used by 
the image owner and a corresponding extraction proce- 
dure used by the receiver of the image. The watermark 

45 insertion procedure computes a hash function of a mod- 
ified image block, a key and various image parameters, 
and then combines the hashed output with a block of 
the watermark bitmap, resulting in a combined image 
block. In the prefen'ed embodiment, tiie modified image 

so block is the original image block with its LSB's set to 
zero. As a final step to create a watermarked image 
blocK the combined image block is inserted into a LSB 
of the modified image. 

[0008] The watermark extraction procedure takes tiie 
55 watermarked image block and aeates two different 
image blocks: a first image block with the LSB's of tiie 
watermarked image block set to zero, and a second 
image block with the LSB's of the watermarked image 
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block extracted. The first image blocK a key and various 
image parameters are used as inputs to the hash func- 
tion. Although the inputs to the hash function for the 
watermark extraction process are different than the 
inputs to the hash function for the watermark insertion 5 
process, the cryptographic hash functions used for both 
watermark insertion and extraction must be identical. If 
the hash functions are different, the watermark will not 
be able to be properly extracted and the extracted 
watermark Image will appear as noise. w 
[0009] The watermark extraction procedure uses the 
hash function to calculate a digest of values, resulting in 
a hashed output. The hashed output is combined with 
the second image block preferably using an exclusive 
OR function. The result of the combined hashed output is 
with the second image block is a block of the extracted 
watermark. 

[0010] The previously described insertion and extrac- 
tion methodology may be used for secret key encryption 
where the same seaet key is used for both watermark 20 
insertion and extraction. In an alternative embodiment, 
the methodology described is modified so that the integ- 
rity and ownership of the image can be verified using a 
public key. In this alternative embodiment, a public key 
encryption step is included after tfie step combining of 25 
the hashed function with the watermark bitmap for the 
watermark insertion procedure. In addition, for tiie 
watermark extraction procedure, a public key decryption 
step is included before the extraction of the watermark 
using the reversible exclusive OR logic function. In such 30 
a system, the owner of the image inserts a watermark 
using a private key K\ In the watermark extraction pro- 
cedure, any person can use the public key K (corre- 
sponding to the private key K) to extract a binary 
watermark, that will indicate any changes that have 35 
been made to tiie watermarked image. 
[001 1 1 The present invention provides authentication 
that detects any change to the watermarked image for 
both a secret key and public key watermarking system. 
Detection of change is important for example where an 40 
image is to be used as evidence for legal purposes and 
in electronic commerce of images, where the buyer of 
an image can be assured that no change to the image 
has occurred when the image is delivered from the 
seller to the buyer. If any part of the image is changed, 4s 
the watermark extraction procedure, according to the 
present invention, will return an output tiiat indicates tiie 
specific parts of tiie image tiiat have been changed. If a 
watermarked image is cropped, tiien the extraction pro- 
cedure will also return an output that resembles random so 
noise, signifying the cropped image is not valid. 
[0012] A further understanding of the nature and 
advantages of tiie present invention may be realized 
witii reference to the remaining portions of the specifica- 
tion and the attached drawings. ss 



BRIEF DESCRIPTION OF THE DRAWINGS 
[0013] 

Figure 1 A shows a block diagram of the watermark 
insertion methodology according to a first embodi- 
ment of tiie present invention. 

Rgure 1 B shows a flowchart of the steps corre- 
sponding to tiie insertion metfiodology shown in 
Rgure 1A. 

Rgure 10 shows alternatives to step 152 of Figure 
1 B (modifying the image block Xp) 

Figure 2A shows a block diagram of the watermark 
extraction metiiodology tiiat is used in combination 
witii the insertion metiiodology shown in Figures 
1A, IB. and 10. 

Figure 2B shows a flowchart of tiie watermark 
extraction procedure that is used in combination 
with the insertion methodology shown in Figures 
1A, IB, and 10. 

Rgure 3 shows an original innage before watermark 
insertion. 

Rgure 4 shows an image watermarked using tiie 
watermark insertion methodologies described in 
Figures lAand IB. 

Rgure 5 shows the extracted watermark output 
image after application of the watermark extraction 
procedure of Figures 2A and 2B when a correct 
user key K is used. 

Rgure 6 shows an extracted watermark output 
image resembling random noise tiiat may occur for 
example, if an image is unmarked, an incorrect key 
is applied, or tiie original image is cropped. 

Rgure 7 shows the watermarked image of Figure 4 
tiiat has been modified by tiie inclusion of a glass. 

Rgure 8 shows tfie extracted watermark from Rg- 
ure 7 indicating tiie specific area where tiie modifi- 
cation to the watermarked Image (the addition of a 
glass) have been made. 

Rgure 9A shows a block diagram of the watermark 
insertion methodology according to a second 
embodiment that implements a public key system. 

Figure SB shows a flowchart of the steps corre- 
sponding to the insertion metiiodology shown in 
Figure 9A. 
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Figure 10A shows a block diagram of the water- 
mark extraction methodology that is used in combi- 
nation with the insertion methodology shown in 
Figures 9A and 9B. 

Figure 10B shows a block diagram of the water- 
mark extraction methodology that is used in con^i- 
nation with the insertion methodology shown in 
Figure 9A and 9B. 

Figure 1 1 shows a summary of the experimental 
results summarizing the properties of the secret 
key verification methodology shown in Figures 1 A 
and 18. 

Figure 12 shows a summary of the experimental 
results summarizing the properties of the public 
key verification methodology shown in Figures 9A 
and 9B. 

Figure 13 shows a high-level block diagram of a 
computer system adapted to execute a software 
program implementing the steps of the waternnark 
insertion methodology according to the present 
invention. 

DETAILED DESCRIPTION OF THE PREFERRED 
EMBODIMENTS 

[0014] The present invention provides a technique for 
embedding and extracting a digital identifier into an 
innage X;„ „ dl M x N pixels, to form a watermarked 
innage n of the same size. Figures 1 A and 1 B show 
a watermark insertion methodology according to a first 
embodiment of the invention. Figures 2A and 2B show a 
watermark extraction methodology according to a first 
embodiment of the invention. The waternrark extraction 
methodology shown in Figures 2 A and 2B should be 
used in conjunction with the watermark inserton meth- 
odologies shown in Figures 1 A and 1 B. 
[0015] Referring to the block diagram in Figure 1A, 
shows a block diagram for innplementing the watermark 
insertion procedure. Figure 1 B shows a flowchart of the 
steps corresponding to the insertion methodology 
shown in Figure 1A. Referring to Figure 1A, an appara- 
tus 100 for implementing the insertion of a waternriark 
into an original input digital image according to the 
present invention would include: a means for modifying 
1 1 0 at least one predetermined bit in an image block Xr, 
wherein the modified image block is X^; a means for cal- 
culating a digest of values 112 using a cryptographic 
hash function, wherein the means for calculating a 
digest of value outputs a hashed output 114, wherein 
the means for modifying 1 10 at least one predetermined 
bit of the image block is electrically coupled to the 
means for calculating a digest of values 112; a means 
for combining 1 16 the hashed output 114 with a water- 
mark 118. wherein the means for combining 116 the 



hashed output 1 1 4 with a watermark 1 18 is electrically 
coupled to the means for calculating a digest of values 
1 12. wherein the output of the means for combining is a 
combined image block; and a means for inserting 126 

5 the combined image block (Cr) into the modified image 
block Xp wherein the means for inserting 126 the com- 
bined image block (Cr) into the modified image block Xp 
is electrically coupled to the means for modifying 1 10 at 
least one predetermined bit of the image block. 

10 [0016] Referring to the flowchart of Figure 1 B. in the 
preferred embodiment the method for inserting a water- 
mark into a digital original input image including the 
steps of: partitioning the image block Xr into at least one 
I X J block (step 150); for each I x J block, nrxxiifying at 

15 least a predetermined bit of the block to a predeter- 
mined value (step 152). wherein the modified image 
block is X^; calculating a digest of the values using a 
CTyptographic hash function (step 154); combining tiie 
hashed output calculated in the previous step witii a 

20 watermark bitmap B^ (step 156). wherein the output of 
the step of combining tiie hashed output witii a water- 
mark Br is an combined image block Cr; and inserting 
the value Cr into the modified image 2(r (step 1 58). 
[0017] The steps shown in Figure IB correspond to 

25 the implementation blocks shown in Rgure 1A. For 
example, the step of calculating a digest of values (step 
154) corresponds to the implementation block 112 in 
Figure 1A. In other words, the step of calculating a 
digest of values is performed by block 112. Similarly. 

30 Step 152 corresponds to block 110. step 156 con-e- 
sponds to block 116 and step 158 corresponds to block 
126. Although Figure 1 B shows a flowchart of the steps 
in Figure 1A, the block diagram shown in Rgure 1A 
clearly shows the inputs and outputs resulting from 

35 each step and tiie sequence of steps. 

[0018] The input to the means for setting a predeter- 
mined bit to a predetermined value is a block of the orig- 
inal input image X^^. In tiie preferred embodiment tiie 
original input image „ is a gray scale image of size M 

40 X N. In an alternative embodiment, tiie original input 
image is color image. In tiie case of a color image, the 
same technique shown in Figures 1A, IB. 10. 2A. 2B, 
9A, 9B. 10A. and 10B can be applied independently to 
tiie color planes of the image, either in the RGB color 

45 space or in any other color space such as for example. 
YUV. 

[001 9] In tiie preferred emtxxliment the image „ is 
partitioned into blocks of I x J pixels. In one emtDodi- 
ment, the partitioned blocks in tiiis application tiie 

50 blocks described are 8x8. although other block sizes 
are possible. Furtiier, the step of partitioning tiie original 
image into I x J pixel blocks may be eliminated (this is 
equivalent to partitioning tiie image into one block, tiie 
image block having a block size where l=M and J=N ). 

55 However, having one block for the entire image is not 
desirable. Partitioning the original input image helps 
maintain localization when authenticating an image. 
Further, partitioning helps the viewer of tiie image more 
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clearly see the location where changes in the image 
have occurred. 

[0020] Let a^ n be a bi-level image that represents the 
watermark to be embedded in X^^,^ Note that a^.n need 
not be of the same size as X^n n- From a^^, „ we can form s 
another bi-level image b^^^ size A/f x A/ (same size as 
n). There are many ways of transforming the image 
am,n into an image the same size as X^^. For example, 
^m,n "T^y be formed by tiling i.e.. periodically rep- 
licating am,n to the desired size. Another possibility is to 
append all zeros (or all ones) to the boundary of a^^, so 
that we obtain f?^ „ of the desired size. 
[0021] For an original input image Xf^ f^ partitioned 
into I X J pixel blocks, let 

be a block of size / x J taken from the image X^ „. For 
simplicity, we are using a single index r to denote the 
block in the image. The corresponding block within the 
binary image b^j^ for tiie watermark bitmap 118 is 
denoted 

Note that / and J can be any number provided they sat- 
isfy IJ^p, where p is the size of the hash function 112. 
[0022] The input to the means for modifying 1 10 at 
least one predetermined bit of a image block to a prede- 
termined value is a rth block of the image X^ In the 
preferred embodiment, tiie bit being set is the LS6 of 
the block. Modifying the LSB of the block causes the 
least visible image distortion, an important factor for an 
invisible watermark. Although the embodiment shown in 
Figure 1A is preferred, other alternative methodologies 
for modifying tiie image block Xr available. However, 
even if alternative methodologies are implemented, it is 
critical that the identical metiiodology for modifying the 
image block (means 110, step 152a) in the water- 
mark insertion process must also be used for modifying 
the watermarked image block Yr (means 210, step 
252a) for the watermark extraction process shown in 
Figures 2A and 2B. 

[0023] In the embodiment shown in Figure 1A. the 
image block X^ is modified by setting the LSB of the 
image block to zero. In an alternative embodiment of the 
embodiment implemented in step 152, a bit other than 
the LSB (or alternatively a group of bits) may be set to a 
predetermined value. In the embodiment shown in Fig- 
ure 1A, the predetermined value is zero, although the 
value determined by tiie system designer may be 
changed. As previously described, although the value of 
the predetermined value and the bit location of the pre- 
determined bit may be changed by the system designer, 
it is critical that the same predetermined bit and prede- 
termined value used in tiie watermark insertion proce- 
dure defined in Figure 1A should also be used in tiie 
watermark extraction procedure defined in Figures 2A 
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and 2B. In other words, if the means for setting a prede- 
termined bit 1 10 of the block of the original input image 
to a predetermined value uses the LSB of the image as 
its predetermined bit and the value zero as its predeter- 
mined value, then tiie means for setting a predeter- 
mined bit 210 in Rgure 2A should use tiie LSB of the 
image as its predetermined bit and the value zero as its 
predetermined value. 

[0024] Figure 1 C shows various alternatives for mod- 
ifying the image block X^ In a first embodiment (as 
shown in Figure 1 A), for each block, a predetermined bit 
of tiie image block Xr is set to a predetermined value. 
However, in an alternative en^txxiiment, for each block a 
predetermined bit(s) would be discarded (step 152b). If 
a predetermined bit(s) is discarded, it is tiiis predeter- 
mined bit(s) that the combined image block Cr is prefer- 
ably inserted in. In a tiiird alternative embodiment, tiie 
image block could be modified according to a pattern of 
bits (step 152c). If a predetermined block is modified 
according to a pattern, it is this pattern of bit(s) that tiie 
combined image block Cr is preferably inserted in (step 
158). Figure 1C shows only three possible alternatives 
for modifying the image block Xp Other alternatives for 
modifying the image block X^ are possible. What is criti- 
cal is that the image block X^ be modified. Preferably, at 
least a portion of the combined image is inserted into 
tiie modified bits of tiie modified image block X^ 
[0025] The output of the means for nnodifying a prede- 
termined bit of the block of the image block is Xp Xf is 
input to both the means for calculating a digest of values 
K, M. N Xr using a cryptographic hash function and a 
means for inserting into a predetermined bit of 
Referring to Rgures 1 A and 1 B. the inputs to the means 
for calculating a digest of values using a cryptographic 
hash function are K (user key), X^ (modified image 
block). M (the width of the original input), and N (tiie 
height of tiie original input block). 
[0026] Referring to Figures 1 A and 1 B show tiie step 
of calculating a digest of ttie values K, M, N, X^ using a 
cryptographic hash function. The cryptographic hash 
function may be chosen from a variety of hash func- 
tions. In tiie preferred emt)odiment, the well known MD5 
function or a variant tiiereof is used. The MD5 function 
is described, for example, in the article The MD5 Mes- 
sage Digest Algorithm," R.L Rivest, Internet RFC 1321, 
April 1992. For ttie rest of this disclosure, we will use 
MD5 as our hash function although in alternative 
embodiments, other cryptographic has functions may 
also be used. 

[0027] In the embodiment described by the present 
invention , K is ttie secret encryption key, Xr is the mod- 
ified original input image block. M is the widtii of tiie 
original input image, and N is tiie height of the original 
input image. Consider a cryptographic hash function 

H(S)=(d,. ds dp) 

where S represents a string of data of arbitrary length. 
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di's are the binary output bits of the hash function, and 
p is the size of the output bit string. It has the property 
that given an input bit string S and its corresponding 
output (di^...,dp), it is computationally Infeasible to find 
another input bit string of any length tfiat will be hashed 5 
to the same output (d^ ...., dp). Using the MD5 hash 
algorithm, any data string may be hashed into a bit array 
of length 1 28, ie. . p = 1 28. If another cryptographic func- 
tion is used, the length p may be different. In the pre- 
ferred emtxxliment. the inequality p^ U is satisfied. 10 
[0028] Let /C be a user key consisting of a string of 
bits. In the preferred embodiment, for each block of data 
Xr we form the con'esponding block Xf where each ele- 
ment in 2(f equals the corresponding element in 
except that the least significant bit Is set to zero. We is 
compute for each block the hash 

H(K, H N, XJ = Id' p d' 2> p}' 

[0029] Then, we select the first U bits in the hashed 20 
output and form the rectangular an-ay „ of size / x J. 
[0030] The hashed output d (dp (fg, (fp) and a 
block of the watermarked bitmap Br are inputs into the 
means for combining the hashed output with a water- 
mark. The process for extracting and inserting a water- 25 
mark both include the step of combining the hashed 
output with the watermark Bp The step of combining the 
hashed output 1 1 4 with the watermark 1 1 8 is performed 
using a bitwise logical operation. This allows easy 
processing for both the watermark insertion and extrac- 30 
tlon processes. In the preferred ennbodiment and as 
shown in Figures 1A and 1B, the bitwise logical opera- 
tion is an exclusive or function. 
[0031 ] Referring to Figure 1 A, the hashed output an^ay 
is confi>ined with By. to form a new binary block Cj using 35 
a pixel by pixel exclusive OR operation. That is, we form 

where © is the exclusive OR operation, and c^ „ are the 40 
elements in b^.n a"'© t^e elements in Br and 4 are the 
elements of the hashed output d. 
[0032] In the preferred embodiment, the final step 
before the creation of the watermarked image is insert- 
ing the value Cr into the modified image In the mod- 45 
ified image t>lock ^ at least one bit of the image block 
is set to a predetermined value. Typically. Cr is only 
inserted in bits that have been modified. Atthough pref- 
erably, each bit that has been modified coresponds to 
an insertion bit of Cp in an alternative embodiment, a bit so 
Cr does not correspond to each nrKxJified bit of the 
image block and therefore a value of Cr is not inserted 
into every modified bit. In the preferred embodiment, 
where the LSB's of the image block are modified to be 
set to zero, and Cr is inserted into the LSB of a value ss 
of Cr is inserted into each modified bit. 
[0033] In the preferred embodiment, we put Cm into 
the least significant bit of the block }(f to form the output 
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block This procedure is repeated for each block of 
data, and all the output blocks are assembled 
together to form the watermarked image Y^nn- T^e 
combined output block Cr and the modified image Xr are 
inputs into a means for inserting C^ into a predeter- 
mined bit of Xp The output of the means for inserting Cr 
Into a predetermined bit of Xf is the output image block 
Yp The output image block a watern^rked image 
block. 

[0034] Ref ending to Figure 2 A shows a block diagram 
200 of the watermark extraction methodology that may 
be used in combination with the insertion methodology 
shown in Figures 1 A and 1 B. The watermark extraction 
process extracts the watermark Br from the image block 
Yr to retrieve the watermark. Referring to Figure 2A, the 
waternnark extraction apparatus includes a means for 
modifying at least a predetermined bit to a predeter- 
mined value 210; a means for extracting a predeter- 
mined bit from the watermarked image block Yri a 
means for calculating a digest of values using a crypto- 
graphic hash function, wherein the means for nriodifying 
a predetermined bit 210 is electrically coupled to the 
means for calculating a digest of values 212; and a 
means for combining 216 the hashed output value 214 
with the extracted image block wherein the means 
for combining 216 the hashed output value 214 with the 
extracted image block Ef220 is electrically coupled to 
the means for extracting 218 a predetermined bit from 
the watermarked image tjlock Yp 
[0035] Referring to Rgure 2A and the flowchart shown 
In 2B shows a method of extracting a watermark from a 
digital image Yp including the steps of: for each I x J 
block, modifying at least a predetermined bit of the 
watermarked image Yr to a predetermined value (step 
252), wherein the modified watermarked image Yr is if ; 
extracting at least a predetermined bit from the water- 
marked image (step 254); calculating a digest of the val- 
ues using a cryptographic hash function (step 256); 
comt»ning the hashed output with the image block Ep 
[0036] Referring to Figure 2A, the inputs to the block 
for calculating a digest of the values K, M, N, Yf using a 
cryptographic hash function are K( the user key), M (the 
Image width of the original image), and N (the image 
height of the original image) and Yr(the watermarked 
image block modified to set a predetermined bit of an 
image block to a predetermined value). Thus, the step 
of modifying a predetermined bit (step 252) of the 
watermarked image block to a predetermined value, 
must be performed before the step of calculating a 
digest of the values (step 256) K, M, N, Y^ using a cryp- 
tographic hash function. 

[0037] After we have obtained the extracted water- 
mark, the extracted watermark can be compared (visu- 
ally, via a computer image comparison program, etc.) to 
an appropriate watermark. For example, the appropri- 
ate watermark may be an image transmitted to the 
receiver at an earlier time for watermark comparison 
purposes. If there is deviation between the two water- 
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marks, then the locations of the deviations indicate the 
regions within the watermarked image that have been 
changed. 

[0038] Rgures 3-8 more dearly shows the properties 
exhibited by images created using the watermarking s 
methodology according to Figures 1A, IB. 2A and 2B. 
For example, Figures 3 and 4 clarify that the watermark- 
ing method described by the present invention imple- 
ments an invisible watermark. Referring to Figure 3 
shows an original inriage before the watermark inser- io 
tion. Figure 4 shows a watermarked image that has 
been watermarked using the watermark insertion meth- 
odologies described in Figures 1 A and 1 B. Comparing 
the Figures 4 and 3, it can be seen that the watermark 
produced is an invisible watermark since there is no vis- is 
ually observable difference between the two images. 
[0039] Another property clearly exhibited by Figures 5 
and 6 is that a correct user key is required for the extrac- 
tion of a proper watermark. If one uses the correct user 
key K and applies the watermark extraction procedure 20 
to Figure 4, one obtains an output image Figure 5, indi- 
cating the presence of a proper watermark In contrast, 
Figure 6 shows an output image resembling random 
noise that may occur for example, if an image is 
unmarked, an incorrect key is applied, or the original 2s 
image is cropped. If an image is unnnarked. i.e., if it does 
not contain a watermark, the watermark extraction pro- 
cedure returns an output that resembles random noise 
as shown in Figure 6. Similarly, if one applies an incor- 
rect key (for example, if one does not know the key), 30 
then the watermark extraction procedure returns an out- 
put that resembles random noise. As another example, 
if a watermarked image is cropped and then one applies 
the watermark extraction procedure on this cropped 
image, the output would resemble random noise. 35 
[0040] Figure 7 shows the watermarked image of Fig- 
ure 4 that has been modified by the inclusion of a glass. 
Figure 8 shows the extracted watermark from Figure 7 
indicating the specific area where the modification to the 
watermarked image (the addition of a glass) have been 40 
made. If one changes certain pixels in the watermarked 
image, then the specific locations of the changes are 
reflected at the output of the watermark extraction pro- 
cedure. Figure 7 shows an image where a glass is 
pasted onto Figure 4. Figure 8 shows the extracted 45 
watermark from Figure 7, indicating the specific area 
where changes have been made. 
[0041] A question that arises is that whether the 
watermark is secure if it is put into the least significant 
bit of the image. Recall that this watermark is designed so 
for authentication purposes, i.e., to detect any change 
to the image. If someone attempts to remove the water- 
mark by changing some bit planes of the image, the 
watermark extraction procedure will detect the changes. 
[0042] A very important issue is whether it is possible ss 
for someone to forge a watermark into the scheme. 
Consider an image block S^. Suppose someone wants 
to alter some or all of the pixels in this image block so 



that it becomes S^. It is necessary that the pixel values 
in the two image blocks satisfy 

H(K, M, N, B,) = H(K M, N, 

[0043] That is, the digest generated from both image 
blocks must be identical. This is considered computa- 
tionally infeasible because of the properties of crypto- 
graphic hash functions such as the MD5 algorithm. 
[0044] In the first embodiment (described and shown 
in Figures 1A. 1B, 1C, 2A, 2B and the accompanying 
text), watermark insertion and extraction is described 
for a secret key system. A second embodiment 
(desaibed and shown in Figures 9A. 98, 10A, 108 and 
the accompanying text in the specification) provides 
watermark insertion and extraction for a public key sys- 
tem. 

[0045] Figure 9A shows a block diagram of an elec- 
tronic system for implementing the insertion of a water- 
mark into an original input digital image for a public key 
system. The block diagram shown in Figure 9A is a 
modified version of the system shown in Rgure 1A, 
where the modifications have been made to include 
public key encryption. Similarly, the block diagram 
shown in Figure IDA is a modified version of the system 
shown in Figure 2A except that the extraction methodol- 
ogy shown in Rgure 10A has been modified to include 
public key decryption. 

[0046] Except for the rrrodifications made for the pur- 
poses of including public key encryption (for example, 
the inputs to the hash function and electrical connec- 
tions have been modified), in general the statements 
made with respect to Figures 1A. 1B, 1C can also be 
made with respect to Figure 9A and 98. Similarly state- 
ments made with respect to Rgures 2A and 28 apply 
with respect to Rgures 10A and 108. For exanrple, the 
statement made with respect to Rgure 1A, that the 
image block Xr may be modified according to the alter- 
natives shown in Figure 1C, is also true for Figure 9A 
(the implementation block 910 may be modified accord- 
ing to the alternatives shown in Rgure 1.) 
[0047] Figure 9A shows a block diagram of the water- 
mark insertion methodology according to a second 
embodiment that implements a public key system. Fig- 
ure 98 shows a flowchart of the steps corresponding to 
the insertion methodology shown in Figure 9A. Similar 
to the image defined in the first embodiment, for the 
public key system we assume a grayscale image X;„ 
having a size of M by N pixels. We want to insert a 
binary invisible Watermark image fe^ „ to x^^^ to obtain 
the watermarked image Similar to the first embod- 
iment, watermark insertion and extraction is performed 
on blocks of image data. For convenience, we chose the 
image block size to be 8 by 8. 
[0048] Referring to Figure 9A. the apparatus for inser- 
tion of watermark for a public key system includes: a 
means for modifying at least a predetermined bit of the 
image block Xr 910; a means for calculating a digest of 
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values using a cryptographic hash function 912. 
wherein the means for calculating a digest of value out- 
puts a hashed output Pr 914, wherein the means for 
modifying 910 at least a predetermined bit of the image 
block is electrically coupled to the means for calculating 5 
a digest of values 912; a means for combining 916 the 
hashed output with a watermark, wherein the means for 
combining 916 the hashed output with a watermark is 
electrically coupled to the means for calculating a digest 
of values 912; a public key encryption means 922 elec- 10 
trically coupled to the means for combining 916 the 
hashed output and watermark; and a means for insert- 
ing 926 the encrypted output and watermark (Wr) into 
the predetermined bit of the block of the image 
wherein the means for inserting is electrically cou- 75 
pled to the means for modifying 910 at least a predeter- 
mined bit the image block. 

[0049] Figure 9B shows a flowchart of the steps cor- 
responding to the insertion methodology shown in Fig- 
ure 9A. Referring to the flowchart of Rgure 9B, the 20 
method for inserting a watermark into a digital original 
input image for a public key system includes the steps 
of: partitioning the original image Xr into I x J blocks 
(step 950); for each I x J block, modifying at least a pre- 
determined bit of the image block (step 952). wherein 25 
the modified image is ; calculating a digest of the val- 
ues using a cryptographic hash function (step 954); 
combining the hashed output calculated in the previous 
step with a watermark B. (step 956). wherein the output 
of the step of combining the hashed output with a water- 30 
mark B^ is a combined image Cp encrypting the com- 
bined image (step 958), wherein the encrypted 
image is W^; and incorporating the value into the 
modified image block is JCp 

[0050] Similar to the methodology desaibed for water- 35 
mark insertion for a secret key system, we let 
denotes the r^ t^lock of data within the image x^^. 
Next, a con^esponding block Xf is formed where each 
element in equals the corresponding element in X,. 
except that a predetermined bit (the least significant bit) 40 
is set to a predetermined value zero. H( • ) be a crypto- 
graphic hash function such as the MD5 algorithm. The 
hash function is computed as follows: 

H(M,N,X^) = (p' ,,p'2 P's) ^ 

where ffi denotes the output bits from the hash func- 
tion, and s is size of the output bits that is dependent on 
the specific hash function used. For example, s =128 for 
MD5. 50 
[0051 ] Denoting the first U bits from the bit stream 
i.e.. 



Pr is combined with a corresponding block in b. 



14 

using a bitwise logic function, typically an exclusive or 
function. That is, we compute C^^ P^^ where © 
denotes the element-wise exclusive OR operation 
between the two blocks. Finally we encrypt with a 
public key cryptographic system to give 

where E(*)\s the encryption function of the public key 
system, and K' is the private key. The binary block of 
data Wr is then embedded into the least significant bit of 
the data block X^ to form a block VV in the watermarked 
image. 

[0052] Figure 10A shows a block diagram of the 
watermark extraction methodology that is used in com- 
bination with the insertion methodology shown in Fig- 
ures 9A and 9B. Figure 106 shows a flowchart of the 
watermark extraction methodology used in Figure 10A. 
The apparatus shown in Figure 10A includes: a means 
for modifying 1010 at least a predetermined bit of a 
block of the watermarked image to a predetermined 
value, wherein the modified image block is Z^; a means 
for extracting 1018 a predetermined bit from the image 
Zp a means for calculating a digest of values 1012 using 
a cryptographic hash function, wherein the means for 
modifying 1010 at least a predetermined bit is electri- 
cally coupled to the means for calculating a digest of 
values 1012; a public key decryption means 1020, 
wherein the output of tiie public key decryption means is 
a decrypted image block Up wherein the public key 
deayption means 1020 is electrically coupled to the 
means for extracting 1018; and a means for combining 
1016 tiie hashed oulput value with the decrypted image 
block Ur, wherein the means for combining the hashed 
output with the modified image block Zf is electrically 
coupled to the public key decryption means 1020 and 
the means for calculating a digest of values 1012. 
[0053] In the extraction procedure, tiie image block 
is used to create two different images. In the preferred 
embodiment, the first image contains the least signif- 
icant bits, and the otiier image ^ contains tiie pixel val- 
ues except that the least significant bits have been 
zeroed out. We then calculate the hash of A/ and Z^, 
and denote the first kJ bits of the output by Q^. We use a 
public key decryption algoritiim to decrypt with the 
public key K that con-esponds to tiie private key /C used 
in the watermark insertion procedure. That is. we calcu- 
late 

Finally, we compute the output k>lock = © Uf. 
using an element-wise exclusive or procedure. 
[0054] In our implementation of the public key water- 
mark insertion and extraction procedures, we used tiie 
MD5 as our hash function, and the RSA public key 
encryption algoritiim for encryption and decryption. If 
both the watermarked image block and the image size 
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had not been changed since the insertion of a water- 
mark, i.e.. if Z, = Y then Z, = X, and = M/^. This 
implies P^-Q^ and U^=C^. Hence the output 
binary image O^-, is identical to the block B^. Othenvise, 
this will not be the case and the output block O^^ will 
appear similar to random noise due to the nature of the 
hash function. As a result, this algorithm can detect any 
change to the pixel values to the block level. 
[0055] Rgure 10A shows a block diagram of the 
watermark extraction methodology that is used in com- 
bination with the insertion methodology shown in Figure 
9A and 9B. Referring to 10B shows a method of extract- 
ing a watermark from a digital image Yp for a public key 
encryption system, including the steps of: for each I x J 
blocK modifying at least a predetermined bit of the 
watermarked image to a predetermined value (step 
1050), wherein the modified watermarked image is 
Zf\ extracting at least a predetermined bit from the 
watermarked image Z^ wherein the extracted image 
block (step 1054) is G^; calculating a digest of the values 
using a cryptographic hash function (step 1052); 
decrypting using a public key decryption function 
l^k(*)> wherein the decrypted image block is Up and 
combining the hashed output with the decrypted image 
block Up 

[0056] Figure 1 1 shows a summary of the experimen- 
tal results summarizing the properties of the secret key 
verification methodology shown in Figures 1A, IB. Sim- 
ilarly, Rgure 12 shows a summary of the experimental 
results summarizing the properties of the public key ver- 
ification methodology shown in Rgures 9A, 9B. Refer- 
ring to Rgures 11 and 12, one way to accomplish 
ownership verification is to associate a user key with a 
watermark so that the desired watermark can only be 
extracted from a watermarked image with the appropri- 
ate user key If the user performs the watermark extrac- 
tion procedure using either an incorrect key or with an 
image that was not watermarked, the user obtains an 
image that resembles random noise. 
[0057] The block diagrams and flowcharts shown in 
Rgures 1A, 1B, 1C, 2A. 2B. 9A, 9B, 10A. and 10B may 
be implemented in either hardware or in software or a 
combination of both. For example, referring to the block 
diagram in Figure 1 A, the computation of the hash func- 
tion (calculating a digest of values) could implemented 
in software, while the exclusive OR function 1 1 6 and the 
modification of a predetermined bit of the image block 
could be performed in hardware. Alternatively, in 
another embodiment, the implementation of the block 
diagram shown in Figure 1A could be implemented 
entirely in software, wherein the software is stored on a 
computer readable media and is adapted to running on 
a conrputer system. 

[0058] Figure 13 shows a high-level block diagram of 
a computer system adapted to execute a software pro- 
gram implementing the steps of the watermark method- 
ology according to the present invention. Central 
processing unit (CPU) 1311 is coupled to a bus 1312 



which in turn is coupled to random access memory 
(RAM) 1313. read only memory (ROM) 1314, input/out- 
put (I/O) adapter 1315, a communications adapter 
1316, user interface adapter 1317. and display adapter 

5 1318. RAM 1313 and ROM typically hold user and sys- 
tem data and programs. Typically, a software program 
implementing the present invention will reside on a stor- 
age medium and will execute on the CPU. 
[0059] It is understood that the above description is 

10 intended to be illustrative and not restrictive. For exam- 
ple, the present invention provides watermarking tech- 
nique for embedding a digital kientifier into an image 
X^ f^ (j^MxN pixels, to form a watermarked image /;„ „ 
of the same size. In an alternative embodiment, the 

15 watermarked image is a different size than the image 
X^ fy. The scope of the invention should therefore be 
determined with reference to the appended claims, 
along with the full scope of equivalents to which such 
claims are entitled. 

20 

C\a\ms 

1 . An electronic system for inserting a watermark into 
a digital image, comprising: 

25 

a means for modifying at least one predeter- 
mined bit in an inriage block to a predeter- 
mined value, wherein the modified image block 
is 

30 

a means for calculating a digest of values using 
a cryptographic hash function, wherein the out- 
put of the means for calculating a digest of val- 
ues is a hashed output, wherein the means for 
35 modifying at least one predetermined bit of the 

image block is electrically coupled to the 
means for calculating a digest of values; 

a means for combining the hashed output with 
40 a watermark, wherein the means for combining 

the hashed output with a watermark is electri- 
cally coupled to the means for calculating a 
digest of values, wherein the output of the 
means for combining is a combined image 
45 block; and 

a means for inserting a first image block into 
the modified image block X^ wherein the 
means for inserting the first image block into 
50 the modified image block X^ is electrically cou- 

pled to the means for modifying at least one 
predetermined bit of the image block 

2. The electronic system recited in claim 1 wherein the 
55 first image block is the combined image tHock Cp 

3. The electronic system recited in claim 1 wherein the 
first image block is an encrypted image block Wp 
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4. The electronic system recited in claim 2 wherein the 
means for combining the hashed output with a 
watermark is electrically coupled to the means for 
inserting the first Image block into the nnodrfied 
image block Xp 

5. The electronic system recited in claim 1 wherein the 
means for modifying at least one predetermined bit 
modifies the LSB of the image block Xp 

6. The electronic system recited in claim 1 wherein the 
means for combining the hashed output with a 
watermark is an XOR logic block. 

7. The electronic system recited in claim 1 wherein the 
means for modifying at least a predetermined bit to 
a predetermined value modifies the at least one 
predetermined bit independently for each color 
plane of the image block. 

8. The electronic system recited in claim 3 further 
including an encryption means, wherein the 
encryption means is electrically coupled to both the 
means for combining the hashed output with a 
watermark and the means for inserting a first image 
block into the modified image block Xp 

9. An electronic system for extracting a watermark 
from a digital image comprising: 

a means for modifying at least a predetermined 
bit of the watermarked image to a predeter- 
mined value; 

means for extracting at least a predetermined 
bit from the watermarked image block; 

means for calculating a digest of values using a 
cryptographic hash function, wherein the out- 
put of the means for calculating a digest of val- 
ues using a cryptographic hash function is a 
hashed output, wherein the means for modify- 
ing at least a predetermined bit of the water- 
marked image is electrically coupled to the 
means for calculating a digest of values; and 

means for combining, wherein the means 
for combining is electrically coupled to the 
means for calculating a digest of values. 

10. The electronic system recited in claim 9 wherein the 
means for combining is electrically coupled to the 
means for extracting at least a predetermined bit 
from ttie watermarked image block. 

11. The electronic system redted in claim 9 further 
including a decryption means, wherein the decryp- 
tion means is electrically coupled to tiie means for 



extracting at least a predetermined bit from the 
watermarked image block and the means for com- 
bining. 

5 12. The electronic system recited in claim 9 wherein the 
means for modifying at least a predetermined bit to 
a predetermined value modifies the least significant 
bit of the image block. 

10 13. A method for inserting a watermark into a digital 
Image including the steps of: 

partitioning the image block Xr into at least one 
I X J block: 

15 

for each I x J block, nradifying at least a prede- 
termined bit of each I x J block to a predeter- 
mined value, wherein the modified image block 
is Xr; 

20 

calculating a digest of the values using a cryp- 
tographic hash function; 

combining the hashed output calculated in the 
25 previous step witii a watermark bitmap Bp 

wherein the output of the step of combining the 
hashed output with a watermark is a com- 
bined image block Cp; and 

30 inserting a first image block into the modified 

image Xp 

14. The method recited in claim 13 wherein the first 
image block is the combined inriage block Cp 

35 

15. The metiiod recited in claim 13 wherein tiie first 
image block is an encrypted image block Wp 

16. The method recited in claim 13 further including the 
40 Step of encrypting the combined image block, 

wherein tiie result of encrypting the combined 
image block is the encrypted image block Wp 

17. The metiiod recited in claim 13 wherein the at least 
45 one predetermined bit of tiie image block X^ is mod- 
ified by discarding the predetermined bit. 

18. The method recited in claim 13 wherein tiie step of 
oiodifying at least one predetermined bit of the 

50 image block Xj a plurality of bits are modified by set- 
ting the predetermined pattern of bits to predeter- 
mined values. 
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